top of page

Privacy Policy
(Updated to reflect Data (Use and Access) Act 2025 requirements)

Introduction

This Privacy Policy explains how I use and protect any information that you give to me during our interactions.

I am committed to ensuring that your privacy is protected. Should I ask you to provide certain information by which you can be identified when using my services, then you can be assured that it will only be used in accordance with this Privacy Notice.

​

Personal Information I will Collect

Personal information that I may collect about you is as follows:

  • Name

  • Age

  • Date of Birth

  • Occupation

  • Address

  • Telephone number (including permission to send text messages and leave a voicemail)

  • Email address

  • Counselling/psychological intervention history

  • Relevant medical conditions

  • Prescribed medication

  • GP name, address, and telephone number

  • Next of kin name and telephone number

  • Session notes

 

Lawful Basis for Processing Information

I process personal and special category data (such as health information) under the UK GDPR and Data Protection Act 2018. My lawful basis for processing is typically:

  • Provision of health or therapeutic services (healthcare provision)

  • Legitimate interests in running a safe and effective counselling practice

 

Where required, I also comply with the Data (Use and Access) Act 2025 (DUAA), which updates and clarifies aspects of UK data protection law.

 

How I Store Your Information

To store your personal information, I mainly use a GDPR-compliant encrypted cloud-based professional software system called WriteUpp. Any information that I may record on paper will be scanned and uploaded to this system and then shredded immediately.

​

I may also store information on various electronic devices, such as telephone numbers or text messages on a password-protected business mobile phone or email account. These will be deleted within one month of our final counselling or hypnotherapy session.

​

Information is stored for 5 years before being permanently erased.

​

It should be noted that I use an accounting software system that I generate invoices from. When you pay by BACS, some basic information is stored in the generation of invoices (name, address and email address), and your name will also appear on my bank statements. This information will also be available to my accountant (and/or bookkeeper) and administrative assistant or should I need to produce bank statements for any personal legal or regulatory reasons. Payment by cash would be the only way of avoiding this – please let me know if you would prefer to pay by this method.

Records are accessible (with some safeguards) to clients at their request.

​

Kelly Porch Counselling and Hypnotherapy (KPCH) is registered with the Information Commissioner’s Office (Registration Number ZA195215)

 

Your Rights Under Data Protection Law (Including DUAA 2025 updates)

Under UK GDPR and the Data (Use and Access) Act 2025, you have rights regarding your personal data, including the right to:

  • Access your personal data (subject access request)

  • Request correction of inaccurate information

  • Request deletion of your data (where applicable)

  • Restrict or object to certain types of processing

  • Request information about how your data is used

 

I will respond to any valid data request without undue delay and within 30 days unless a legal exemption applies.

DUAA 2025 also strengthens expectations around transparency and ease of exercising rights, meaning I aim to make any such requests as straightforward as possible.

 

When I Will Share Your Information

Everything you tell me will be confidential in most circumstances. However, there are some exceptions to this:

​

Prevention of Harm

If I feel at any point that you or someone else is at significant risk of serious harm, I may have to share information with appropriate services.

 

Legal Requirements

If I am ordered by a court, I will be required to share information about you. It is therefore essential that you inform your counsellor of any forthcoming court case that you may be involved in. There are also legal requirements to share information should there be involvement in matters such as money laundering, drug trafficking, terrorism, or applicable aspects of the Road Traffic Act 1988.

​

Clinical Supervision

In accordance with guidelines set by the National Counselling and Psychotherapy Society (NCPS) and the National Council for Hypnotherapy (NCH), I receive regular clinical supervision where I discuss my clients with a qualified supervisor to ensure safe and ethical practice.

If my work with you is discussed, I will only use your first name. My supervisor may also have access to your basic contact information should I become incapacitated, as part of a clinical will arrangement.

​

Teaching Practice

I own a counselling training centre, Northamptonshire Centre for Counselling Studies (NCCS). To support training of counsellors, anonymised material from client work may be used for teaching purposes. All identifying details are removed so that individuals cannot be identified.

​

Data Protection Complaints (DUAA 2025 requirements)

If you are unhappy with how your data has been handled, you have the right to make a complaint. In the first instance, please contact me directly so I can try to resolve your concern. If you remain dissatisfied, you also have the right to complain to the Information Commissioner’s Office (ICO). I aim to acknowledge and respond to data protection complaints promptly within 30 days and in line with applicable legal expectations under UK data protection law and DUAA 2025.

​

Location-Based Services

If you have GPS tracking enabled applications on your mobile phone, Apple Watch (or equivalent), Smart Tag or other device, it may be possible for others to identify that you are attending sessions at KPCH (e.g. attending the same place at the same time each week). You may wish to adjust your settings if you do not want this to occur.

​

Data Retention

KPCH will use email or text to communicate, rearrange or cancel counselling/hypnotherapy sessions. It is requested that specific therapeutic content is not emailed, and I will not respond to clinical content via email.

​

Please note that any emails sent between us, or any websites accessed, may be recorded and retained for a period by Internet Service Providers (ISPs). Although highly unlikely, ISPs may be able to access data stored in logs.

​

Any emails between you and me may also form part of your clinical record.

​

Social Media

KPCH has various social media accounts (LinkedIn, Facebook, Instagram), which you are free to follow or like, but there is no expectation to do so.

These accounts are mainly used to share inspirational quotes, useful articles, and signpost to the KPCH website.

It is your choice whether to comment on these accounts, but please be aware that others may infer that you are receiving counselling/hypnotherapy, which may compromise your privacy.

​

These accounts will not be used for counselling communication. Please use the website contact form or telephone instead.

​

KPCH will not accept friend requests from current or former clients and will not initiate friend or follow requests to clients.

​

Business Review Sites

You may have come across KPCH via sites such as Counselling Directory or Google Business Profile. These platforms may allow users to leave reviews.

While reviews are appreciated, you are under no obligation to provide one. If you choose to leave a review, please be aware that it is publicly visible and may indirectly reveal your identity or involvement with counselling.

​

Changes to This Privacy Policy

This policy may be updated from time to time to reflect changes in law, including updates under UK GDPR or the Data (Use and Access) Act 2025.

The most recent version will always apply.

UPDATED ON 21ST APRIL 2026

bottom of page